Planning certificate

Zones with mandatory day-ahead steering publish the Fall-Back Flex plan through the Fluvius planning API. That API has no API keys, no accounts and no shared secrets: the only way in is a client certificate presented in a mutual TLS (mTLS) handshake. Without a valid certificate the controller cannot fetch the plan and cannot acknowledge it, which Fluvius counts as a non-delivered service.

The certificate is bought by the grid user (the customer, the DNG in the Fluvius documents), not by Voltmasters. It confirms the legal existence of your company, so only your company can complete the validation with the certificate authority. Once issued, Fluvius couples the certificate server-side to one asset point id and scopes everything the API returns to that connection. The EMS therefore selects nothing itself: whatever the API answers on this certificate belongs to this connection.

What Fluvius requires

Fluvius leaves the choice of certificate authority to you, as long as the certificate meets these requirements.

Before you order

An OV certificate is issued to a company, not to a person or a device. Have the following ready:

• the legal name, address and company number (in Belgium the KBO/BCE number) exactly as they appear in the official register;
• a phone number on which the CA can reach your company, listed in a public source the CA accepts (the company register, an official directory or your own domain);
• a domain name you control, with access to its DNS records or to an email address on that domain: the CA validates domain control as part of the order;
• a technical contact who can receive the issued files and keep the private key safe;
• the asset point id Fluvius assigned to the connection, from the bid form or zone sheet.

Where to buy one

Any recognised commercial CA that issues OV certificates qualifies. The most commonly used ones, with the page where the OV product is ordered:

Buying through a reseller is fine too and is often cheaper. Belgian resellers that carry the OV products of the CAs above include Kinamo and Combell. What matters is the certificate itself, not who sold it.

Ordering step by step

1. Generate a private key and a CSR

   Generate the key pair yourself and keep the private key: a CA never needs it, and a key that was mailed around cannot be trusted any more. On any machine with OpenSSL:

   openssl req -new -newkey rsa:2048 -nodes \
     -keyout fluvius-planning.key \
     -out fluvius-planning.csr \
     -subj "/C=BE/O=Your Company NV/CN=ems.yourcompany.be"
   

   Use a domain you control as CN, and fill in O with the legal company name as it appears in the register. -nodes leaves the private key without a passphrase, which is what the platform expects on upload.

2. Order the OV certificate

   Order the OV product with the CA or reseller of your choice and submit the CSR from the previous step. Ask explicitly for Client Authentication in the extended key usage: most OV TLS products carry both server and client authentication, but a server-only certificate cannot be used for mTLS. Mention that the certificate is used as a client certificate in a machine-to-machine setup.

3. Complete the organisation validation

   The CA verifies the legal and physical existence of your company against the official register and a public directory, and calls the published phone number. Answer their requests quickly: this step decides the lead time. The CA may ask for a recent extract from the company register.

4. Collect the issued files

   You receive the certificate and the CA chain (intermediate plus root). Together with the private key from step 1 that is everything you need. The platform expects PEM (.pem, .crt, .cer for certificates, .pem or .key for the private key). See file formats if your CA delivered a PKCS#12 or DER file.

5. Register the certificate with Fluvius

   Send the public certificate (never the private key) to FRPflex@fluvius.be, together with the asset point id it must be bound to. Fluvius couples the certificate to that asset point; until that coupling exists the API answers UNAUTHORIZED_CERTIFICATE or FORBIDDEN, even with a perfectly valid certificate.

6. Upload it in the platform

   Under Configuration → Grid & market → DSO RTU settings, in the Fall-Back Flex section, upload the client certificate, the private key and optionally the CA chain, and fill in the asset point id. The platform checks that the certificate is readable, that the key belongs to it and that it has not expired, then shows the thumbprint and the expiry date. The controller picks the credentials up within a minute.

7. Verify

   On the Fall-Back Flex page the day-ahead plan must appear after the next Fluvius publication (around 12:00 for the following day). Check that no Fluvius planning API unreachable incident is raised. When in doubt, ask Voltmasters support to check the handshake on the controller.

File formats and conversions

The platform stores the certificate and the key as PEM. PEM is text and starts with -----BEGIN CERTIFICATE----- or -----BEGIN PRIVATE KEY-----. If your CA delivered something else:

The private key must be uploaded without a passphrase: the platform does not ask for one, and an encrypted key is rejected as unreadable. Keep the original encrypted copy in your own password manager.

Renewal

A certificate is valid for at most one year, so renewal is part of running a Fall-Back Flex connection, not an exception.

Renewing without a gap:

1. Order the new certificate 6 to 8 weeks before the expiry date, with a new key pair (a renewal is a new order with the CA, not an extension).
2. Send the new public certificate to FRPflex@fluvius.be, at the earliest 90 and at the latest 15 days before the expiry date, and mention the asset point id and the expiry date of the current certificate.
3. Once Fluvius confirms the new coupling, upload the new certificate and key in the same form. The upload replaces the stored files and restarts the reminder cycle on the new expiry date; the expiry incident is resolved once the controller runs on the new certificate.

Troubleshooting

Frequently asked questions

Can Voltmasters order the certificate for us?

No. The organisation validation confirms the legal existence of the company that holds the grid connection, so the order has to be placed by that company. Voltmasters helps with the CSR, the conversion of the files and the verification afterwards.

Can we use the certificate of our website?

Technically yes if it is an OV certificate that includes client authentication and its private key is available, but it is a bad idea: a certificate that also serves the public website ends up on web servers and expires on the website's schedule. Order a separate certificate for the EMS.

Can we test the planning API before going live?

Not on a test environment: Fluvius only grants access within a concrete connection file and has none for product development. Order and register the certificate early, and use the first Fluvius publication after the registration (around 12:00 for the following day) as the verification.

Do we need this certificate without day-ahead steering?

No. In zones with pure live steering, Fall-Back Flex runs entirely over the Netflex RTU, which needs no certificate. The planning certificate is only required when the zone sheet states that day-ahead steering is mandatory.

What happens during an activation when the certificate has expired?

The live steering keeps working: the Netflex RTU link is independent of the planning API. What is lost is the day-ahead preparation (charging the battery before a restriction) and the acknowledgement of the plan to Fluvius, which is a contractual obligation. Fix it as fast as possible.